Skip to content

fix(docs): correct misleading implant cleanup statement across third-party executors#291

Open
Copilot wants to merge 2 commits intomainfrom
copilot/fix-docs-executors-implants-statement
Open

fix(docs): correct misleading implant cleanup statement across third-party executors#291
Copilot wants to merge 2 commits intomainfrom
copilot/fix-docs-executors-implants-statement

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 4, 2026

The docs incorrectly claimed implant directories are "deleted on assets' restart" — a client confirmed runtimes/ and payloads/ persist indefinitely after restart, contradicting this.

Changes

docs/deployment/ecosystem/executors.md

Replaced the inaccurate single-sentence cleanup claim in all four third-party executor sections (Tanium, CrowdStrike, SentinelOne, Palo Alto Cortex) with a structured bullet list:

  • Each implant directory is unique per inject.
  • Old implants are periodically cleaned up by the OpenAEV platform based on the clean-implant-interval configuration parameter (default: 8 hours).
  • This cleanup is performed server-side — implant directories are not automatically deleted on endpoint restart.

The clean-implant-interval parameter already existed in each executor's config table but was never referenced in the prose.

docs/usage/openaev-agent.md

Expanded the bare "Execution cleanup and directory pruning" feature bullet into sub-bullets covering:

  • Agent-side pruning of runtimes/implant-XXXXX on implant process exit
  • payloads/ directory cleanup after payload delivery
  • Edge case: residual directories when the agent is offline or a process is killed externally, with the server-side clean-implant-interval sweep as the fallback

Copilot AI linked an issue May 4, 2026 that may be closed by this pull request
Copilot AI changed the title [WIP] Fix misleading implants cleanup statement in executors documentation fix(docs): correct misleading implant cleanup statement across third-party executors May 4, 2026
Copilot AI requested a review from RomuDeuxfois May 4, 2026 07:08
@RomuDeuxfois RomuDeuxfois marked this pull request as ready for review May 4, 2026 09:11
@RomuDeuxfois RomuDeuxfois force-pushed the copilot/fix-docs-executors-implants-statement branch from c020087 to 41f0013 Compare May 4, 2026 09:47
@RomuDeuxfois RomuDeuxfois force-pushed the copilot/fix-docs-executors-implants-statement branch from c8e59d8 to 4bcbf9b Compare May 4, 2026 11:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[docs] fix(executors): correct misleading implant cleanup statement

3 participants